PHP BBCode Style Replacement

[blackfire88]

I want to make it so that there can be a random var inside of a replacement
so

replace [blah] %var% [/blah] with <blah> %var% </blah>

So the %var can be anythin as long as there is [blah] and [/blah] around it.

[Spero78]

You can use str_replace() in php to parse BBCode

For example you can do

str_replace("[blah]","<blah>"); 

You can extend that by using an array of BBCodes or even a regular expression, I'm on my iPhone right now so can't explain that too well

[swift and shift]

preg_replace_callback

[reeferdk]

Don't use str_replace. Instead use some regex, or alternatively this PECL extension: [URL]http://php.net/manual/en/book.bbcode.php[/URL]

There is an example on using regex to do it here [url]www.php.net/manual/en/function.bbcode-create.php#93349[/url]

[Fate]

Potentially you could even do it with Javascript, if you wanted. Although PHP would be far superior.

[TerabyteS_]

[QUOTE=SataniX;34989488]Potentially you could even do it with Javascript, if you wanted. Although PHP would be far superior.[/QUOTE]

That's a very unsafe thing to do. It could lead way to some nasty XSS exploits.

[Fate]

[QUOTE=TerabyteS_;34990202]That's a very unsafe thing to do. It could lead way to some nasty XSS exploits.[/QUOTE]
Surely not if you're only doing something like this?

document.getElementByID('x').innerHTML = document.getElementById('x').innerHTML.replace(/\[hr\]/, '<hr />');

HR used purely as an example.
I understand it would be vulnerable if it was in a [x=y]axy[/x] form though.

[Uglehs]

Example for bold

$text = preg_replace('#\[b\](.*?)\[/b\]#si', '<strong>\1</strong>', $text);

Example for center

$text = preg_replace('#\[center\](.*?)\[/center\]#si', '<div style=\'text-align:center\'>\1</div>', $text);

<center>'s deprecated replacement

Example for color.

$text = preg_replace('#\[color=(black|blue|brown|cyan|gray|green|lime|maroon|navy|olive|orange|purple|red|silver|violet|white|yellow)\](.*?)\[/color\]#si', '<span style=\'color:\1\'>\2</span>', $text);
$text = preg_replace('#\[color=([\#a-f0-9]*?)\](.*?)\[/color\]#si', '<span style=\'color:\1\'>\2</span>', $text);

First line for words, second line for hex.

[swift and shift]

[QUOTE=Uglehs;35003477]Example for bold

$text = preg_replace('#\[b\](.*?)\[/b\]#si', '<strong>\1</strong>', $text);

Example for center

$text = preg_replace('#\[center\](.*?)\[/center\]#si', '<div style=\'text-align:center\'>\1</div>', $text);

<center>'s deprecated replacement

Example for color.

$text = preg_replace('#\[color=(black|blue|brown|cyan|gray|green|lime|maroon|navy|olive|orange|purple|red|silver|violet|white|yellow)\](.*?)\[/color\]#si', '<span style=\'color:\1\'>\2</span>', $text);
$text = preg_replace('#\[color=([\#a-f0-9]*?)\](.*?)\[/color\]#si', '<span style=\'color:\1\'>\2</span>', $text);

First line for words, second line for hex.[/QUOTE]

potentially vulnerable to xss

[Uglehs]

[QUOTE=swift and shift;35003550]potentially vulnerable to xss[/QUOTE]

Obviously, im not fucking retarded. I never said use that code by itself, It was an example of what OP requested. What am I supposed to make the whole script or an EXAMPLE, which I stated?
So do not disagree a post because you want to be a jackass, you can instead point out to the OP that he should add xss prevention if he was to use that bit of code ever.

Also instead of stating the obvious, you could of posted (for the op) a way to prevent xss.

You can use something like this to prevent xss

function stripinput($text) {
	if (!is_array($text)) {
		$text = stripslash(trim($text));
		$search = array("&", "\"", "'", "\\", '\"', "\'", "<", ">", "&nbsp;");
		$replace = array("&amp;", "&quot;", "&#39;", "\", "&quot;", "&#39;", "&lt;", "&gt;", " ");
		$text = preg_replace("/(&amp;)+(?=\#([0-9]{2,3});)/i", "&", str_replace($search, $replace, $text));
	} else {
		foreach ($text as $key => $value) {
			$text[$key] = stripinput($value);
		}
	}
	return $text;
}

I didn't make it, but I have always used it in my project maincores.

[swift and shift]

html_special_chars

[editline]5th March 2012[/editline]

also it can be super easy to fuck up bbcode if you're not careful

[Jelly_]

[QUOTE=Uglehs;35003761]Obviously, im not fucking retarded. I never said use that code by itself, It was an example of what OP requested. What am I supposed to make the whole script or an EXAMPLE, which I stated?
So do not disagree a post because you want to be a jackass, you can instead point out to the OP that he should add xss prevention if he was to use that bit of code ever.[/QUOTE]

Holy fuck don't be so god damn aggressive he was just pointing out an obvious flaw, your fault for not elaborating.

[jaybuz]

Use markdown. It's easier for everybody.

[StinkyJoe]

[QUOTE=Uglehs;35003761]

function stripinput($text) {
	if (!is_array($text)) {
		$text = stripslash(trim($text));
		$search = array("&", "\"", "'", "\\", '\"', "\'", "<", ">", "*");
		$replace = array("&", """, "'", "\", """, "'", "<", ">", " ");
		$text = preg_replace("/(&)+(?=\#([0-9]{2,3});)/i", "&", str_replace($search, $replace, $text));
	} else {
		foreach ($text as $key => $value) {
			$text[$key] = stripinput($value);
		}
	}
	return $text;
}

I didn't make it, but I have always used it in my project maincores.[/QUOTE]

Sir, I'm here to confiscate your php and maincores, please come with me.

[Uglehs]

[QUOTE=StinkyJoe;35010708]Sir, I'm here to confiscate your php and maincores, please come with me.[/QUOTE]

I used it for arrays.